Overview

overview

7

Static

static

3

2026-10-02...op.exe

windows10-2004-x64

7

2026-10-02...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/10/2026, 18:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
  • Size 4.5MB
  • Sample261003-wvftfsthkb
  • SHA256 8c6d20e304e3760ca0c6893f580bc3afe8fc6ad8baa09fdc2f54cfc563d3f890
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4752
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64BB.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5364
      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5096
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a694F.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4332
          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3456
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BEF.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2188
              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:2136
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E70.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:708
                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5780
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7100.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4788
                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3504
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7332.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5064
                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:612
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75D2.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:1784
                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3848
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7834.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:3116
                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2576
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82D2.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2472
                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:2172
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8505.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1852
                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:3388
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a887F.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:5756
                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:4296
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9011.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4380
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5524
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ACF.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1344
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:936
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D50.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1916
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3112
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0BB.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5012
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4328
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA30C.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4724
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5104
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA520.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1932
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5900
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA762.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3240
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2368
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1476
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3368
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB25E.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2396
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5368
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB462.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5844
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4632
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB665.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3876
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4544
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB740.bat
                                                                                              46⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:868
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4612
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB80B.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2572
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5748
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8F6.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3352
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4916
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9D0.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:684
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:260
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA8C.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1980
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3364
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB28.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4444
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5268
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC03.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2236
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3132
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCAF.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:1088
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1092
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD7A.bat
                                                                                                                              62⤵
                                                                                                                                PID:2464
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:3852
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE45.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:1352
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:564
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEE1.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:1748
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:6076
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF8D.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2456
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:6048
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC058.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:2428
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:2968
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC123.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:1048
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:2700
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1EF.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:4520
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:3872
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC28B.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2320
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:5464
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC346.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:3000
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:3224
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC411.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                            PID:3584
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:5656
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4CD.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:1200
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:4880
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC579.bat
                                                                                                                                                                                    84⤵
                                                                                                                                                                                      PID:2544
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        PID:4116
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC625.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                            PID:1816
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:4400
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6F0.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:5320
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2016
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7BB.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:1660
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:2872
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC876.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:928
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:1224
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC922.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:5076
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:5156
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA0D.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                  PID:5220
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:4340
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAD8.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:1248
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:2088
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB93.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:1724
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:4200
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC4F.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                PID:4668
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:4388
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCFB.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:4428
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDB6.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:2752
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:2884
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE72.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                PID:1192
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:1300
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF3D.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2888
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:3756
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD027.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:3332
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:5228
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0F2.bat
                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                              PID:2648
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:3620
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1AE.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:5952
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:5660
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD25A.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:1988
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:4796
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD325.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:3376
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            121⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:5016
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3E0.bat
                                                                                                                                                                                                                                                                              122⤵
                                                                                                                                                                                                                                                                                PID:4072
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:3884
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD49C.bat
                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                      PID:2620
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:4508
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD538.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:3768
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:5324
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5D4.bat
                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:3404
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:4672
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD690.bat
                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                    PID:5208
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:4264
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD72C.bat
                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:1912
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                            PID:5384
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7D8.bat
                                                                                                                                                                                                                                                                                                              134⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:5708
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                135⤵
                                                                                                                                                                                                                                                                                                                  PID:5316
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD893.bat
                                                                                                                                                                                                                                                                                                                    136⤵
                                                                                                                                                                                                                                                                                                                      PID:2820
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        137⤵
                                                                                                                                                                                                                                                                                                                          PID:2316
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD97E.bat
                                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                                              PID:3296
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:3928
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA2A.bat
                                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                                    PID:3656
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:3608
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAF5.bat
                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:4920
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:4368
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBC0.bat
                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:5216
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:2468
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC8B.bat
                                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:540
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5608
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD56.bat
                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:3148
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:3764
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDF2.bat
                                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:1696
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                              PID:816
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE8F.bat
                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5592
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:2120
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF3B.bat
                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1788
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFD7.bat
                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:2224
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3688
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE063.bat
                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1924
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:688
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE12F.bat
                                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3772
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:616
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE296.bat
                                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:200
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE332.bat
                                                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1604
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE46B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1736
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE517.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:252
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5A3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE64F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1480
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE853.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE90E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE99B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA37.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAD3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB8F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC79.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED25.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDD1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFA6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF042.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF16B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF207.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2A3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF340.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF488.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF514.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF67C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF728.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF870.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF90C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF999.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAC1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC0A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC96.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD23.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEC9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4456
                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates a file in the Startup directory
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:5072
                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                    3⤵
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:4600
                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:4224

                                                                                                                                                Network

                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                      Reconnaissance

                                                                                                                                                      Resource Development

                                                                                                                                                      Initial Access

                                                                                                                                                      Execution

                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                      1
                                                                                                                                                      T1059

                                                                                                                                                      Windows Command Shell

                                                                                                                                                      1
                                                                                                                                                      T1059.003

                                                                                                                                                      Persistence

                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                      1
                                                                                                                                                      T1547

                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                      1
                                                                                                                                                      T1547.001

                                                                                                                                                      Privilege Escalation

                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                      1
                                                                                                                                                      T1547

                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                      1
                                                                                                                                                      T1547.001

                                                                                                                                                      Defense Evasion

                                                                                                                                                      Credential Access

                                                                                                                                                      Credentials from Password Stores

                                                                                                                                                      1
                                                                                                                                                      T1555

                                                                                                                                                      Credentials from Web Browsers

                                                                                                                                                      1
                                                                                                                                                      T1555.003

                                                                                                                                                      Unsecured Credentials

                                                                                                                                                      1
                                                                                                                                                      T1552

                                                                                                                                                      Credentials In Files

                                                                                                                                                      1
                                                                                                                                                      T1552.001

                                                                                                                                                      Discovery

                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                      1
                                                                                                                                                      T1120

                                                                                                                                                      Query Registry

                                                                                                                                                      1
                                                                                                                                                      T1012

                                                                                                                                                      System Information Discovery

                                                                                                                                                      1
                                                                                                                                                      T1082

                                                                                                                                                      System Location Discovery

                                                                                                                                                      1
                                                                                                                                                      T1614

                                                                                                                                                      System Language Discovery

                                                                                                                                                      1
                                                                                                                                                      T1614.001

                                                                                                                                                      System Network Configuration Discovery

                                                                                                                                                      1
                                                                                                                                                      T1016

                                                                                                                                                      Lateral Movement

                                                                                                                                                      Collection

                                                                                                                                                      Data from Local System

                                                                                                                                                      1
                                                                                                                                                      T1005

                                                                                                                                                      Command and Control

                                                                                                                                                      Exfiltration

                                                                                                                                                      Impact

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      $$a64BB.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a64BB.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 9f7fb3bc4dd3d33a7277373c2358dbce1579d78515dea628d74822cee8478e5f
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a694F.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a694F.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 36ddd20729288cca1073cf3b85d03271fcb4bb092ff2e1ac758d12cff8b10cfe
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a6BEF.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6BEF.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 c92f522792b3aa79418967abdcc83bbe4f3f60446a14871f112299c4edc0ba9a
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a6E70.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6E70.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 2aaede117c334438f481be117eba826b75205ff8f996bf1e9115988c82fb0112
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a7100.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7100.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 dfe0c80aff4ce532f9bd8a29e74332c53555af5d9db1cf9d3754fecfedecb811
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a7332.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7332.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 53b94a56faee8d3456025d1f3f49464d1671a0f589dde13065ec59dc593c1c3a
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a75D2.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a75D2.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 173d141d491e2e9525e7cccafb6339f584063f887a54fa893912284b4a2d2e01
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a7834.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7834.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 33c6a94df9a58cb7364d53c6b96d67dadaddc6a7a25e5c3e06e31958fbdddc9c
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a82D2.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a82D2.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 2f3f32aa886cdb99a7ad15c3df20621902750885955038e01245e91b39121f64
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a8505.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8505.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 31b7aa34f8a5641fbc404851c6adae1debd2e39dcf1f5b04fb29fc1bf6df8f2e
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a887F.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a887F.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 db08a98024c5b2d2c67fa941304026046edd71e5a3b6625c959a425238a8e93e
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a9011.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9011.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 b37972e5a45e3eddfc7fce20284ae7f04ed275bf2e1e4bf8b7e72bd403bd3245
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a9ACF.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9ACF.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 3eed322b5c3141b16bc37eb658ab83083c6c8250c250a1b4c3d15a5b1c380b51
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$a9D50.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a9D50.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 62b40e0ce815f475365a64d00edc4180882c0b51bcfbf12b5bda412194496bc6
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aA0BB.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA0BB.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 0f1fc2eb2bbb216c414b42896d7034f3f277c16aa5ded4e442f3be54b8ac1af1
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aA30C.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA30C.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 00d71a36ba956cbfab66d135a720a6b4fa6cb486d8b6e7d47308d07fc5a72bdf
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aA520.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA520.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 750f5ffbd89d0e00b40e420f46050967e5788d98fa920e3331318f32d7ca81a2
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aA762.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA762.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 aeb711afba6b5ca12fbd9c7a5a2b9e954e9457fdf1db2a1a4b67af6168d05cf6
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aB0B8.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 98af15b1e36e73f8abbec48a7535dab02968553dd853a3ebe7b190606fbf0447
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aB25E.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB25E.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 60b271b5e98e7e926fa65245364b97b4a142cb22047f0c40e5214cdf57f7ca0b
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aB462.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB462.bat
                                                                                                                                                      • Size 776B
                                                                                                                                                      • SHA256 88d8258e632e35498ff5ead8a257b6ff03ef3c9f7d45ca7c54425292e844a3e8
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.1MB
                                                                                                                                                      • SHA256 acd63c96208cc16503db557af2e5388996bf3928235d3dd69174a01d01823c0e
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.0MB
                                                                                                                                                      • SHA256 fe3759f019e2d11edb0ff028845a63553a8080013cd27650002e7e999d156d99
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 3.9MB
                                                                                                                                                      • SHA256 86b8cf59347a11edeac42cbc3efbb4ce9219397de42d7cb5f860e2c6caffb002
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.1MB
                                                                                                                                                      • SHA256 4b3effe011dd3bb1b2a42ca81cb4d9ac202e83dfa08b0db1173c42d370fbefc6
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.0MB
                                                                                                                                                      • SHA256 45dfe068dc9f6ae1f9811dbf10c4a35cef93a8fe9401104b1a9cb326ad89a3a0
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.1MB
                                                                                                                                                      • SHA256 17da4f41fec91ca475a925d5001d240684590072981cb9b3c9b5061ba2ed54d2
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.2MB
                                                                                                                                                      • SHA256 33a3b3288f45e27e1a294f63cff93a65a1f0ce732e3412b57c290b0f3361c465
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.0MB
                                                                                                                                                      • SHA256 659ae50dc8924bff82efd19916631e63fca6c96b83272237158302c305780412
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.2MB
                                                                                                                                                      • SHA256 55c1b667a4a5ac586c56b3a8afc698a5f9a7348dbfdd4384bd563896f4084a42
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 3.9MB
                                                                                                                                                      • SHA256 32547416ac43659c8fb2fae67a57de70e35b6d96b2a7a243b06aab300fbc8a41
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 3.9MB
                                                                                                                                                      • SHA256 6dfc8e13573026620df81cdb1ff4ae7acdc261f758d8265db7ab2e0749ed9e65
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.5MB
                                                                                                                                                      • SHA256 13be6538ee4d8bc8a1a0b99108e08a81f5b31ec8a4123f321a66ab6c83698dfb
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.4MB
                                                                                                                                                      • SHA256 eefaaf78b5472358e0f533af7df8982a51afa0f883baaaa198389c5e44a3df60
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.4MB
                                                                                                                                                      • SHA256 cae496ea5168c2c6a3cdceb78906b4f026928d6bff2fe4abc322fe915d31d2a3
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.3MB
                                                                                                                                                      • SHA256 119a5bee8b4d4d194b72b775174580ea4fa71bd76e4640d65dd78e1b29cfe021
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.4MB
                                                                                                                                                      • SHA256 241336cd26766a810ce5bb6868c8944b73be8fae16910411d7820022f657389f
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.3MB
                                                                                                                                                      • SHA256 0432a5234783b24ef2888be6bf9267bd67419ff23ae2b8265e091d0c57a8abff
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.3MB
                                                                                                                                                      • SHA256 e4cd0861b164e826f18542a01907a46f521bfe3d64648b88afca121c3fc103cd
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.2MB
                                                                                                                                                      • SHA256 adc7f308ab8b4385d70beaf5068574c21f662290abbdd6b3d1a03b94b7de11fc
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-10-02_01ef6aad695ddbd941630fa63f2889ac_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                      • Size 4.2MB
                                                                                                                                                      • SHA256 4c701392eec3cf3ace5d6b79d1f35064061153664bec563bc7fde7eb8f015d62
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      Logo1_.exe
                                                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                                                      • Size 32KB
                                                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _desktop.ini
                                                                                                                                                      • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                                                                      • Size 9B
                                                                                                                                                      • SHA256 004b1cc70b055dd97ad5615423416608553b34793b54437a15a4fcd3e84907ab
                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                      Submit Download

                                                                                                                                                      memory/260-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/420-8944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/564-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/612-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/616-8636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/688-8629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/816-8601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/936-5604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/984-8755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1092-8317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1184-8895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1224-8413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1236-8923-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1260-8769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1284-8650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1300-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1480-8692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1712-8874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1736-8671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1780-8832-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1868-8960-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1868-8966-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1920-8860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1940-8713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1996-8706-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2016-8401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2088-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2120-8608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2136-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2172-1866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2316-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2344-8902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2348-8888-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2368-8235-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2432-8727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2468-8580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2576-1551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2700-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2796-8853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2844-8867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2864-8958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2872-8407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2876-8748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2884-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2936-8790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2968-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3112-6074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3132-8311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3224-8371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3308-8776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3364-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3368-8244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3388-1876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3456-36-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3504-73-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3568-8741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3608-8566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3620-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3688-8622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3756-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3764-8594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3848-93-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3852-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3872-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3884-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3928-8558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4116-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4180-8657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4200-8437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4264-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4268-8783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4296-3709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4328-6083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4340-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4368-8573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4388-8443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4400-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4428-8449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4476-8699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4508-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4544-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4612-8275-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4632-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4636-8846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4672-8523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4700-8825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4752-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4752-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4796-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4832-8811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4836-8615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4844-8930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4864-8881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4880-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4916-8287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4968-8804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5016-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5072-8251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5072-2782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5072-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5072-1169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5088-8951-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5096-26-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5104-6096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5136-8937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5156-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5160-8685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5228-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5236-8643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5268-8305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5288-8678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5316-8544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5324-8516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5356-8916-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5368-8256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5384-8537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5464-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5524-5595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5608-8587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5656-8377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5660-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5716-8839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5724-8734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5748-8281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5780-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5840-8664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5900-6105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5992-8762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5996-8818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6044-8909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6048-8341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6064-8797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6076-8335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6088-8720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download