Overview

overview

7

Static

static

3

2026-09-08...op.exe

windows10-2004-x64

7

2026-09-08...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 01:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
  • Size 6.3MB
  • Sample260910-brglcstblb
  • SHA256 a77d6f1935ddccf8e581b8c743bee6ea4d2e2dd613b7c18e1c28e88f5e9ef56c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3F.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3912
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1265.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:7112
          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5516
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a168C.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4312
              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1004
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19B8.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1864
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:688
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D23.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:6960
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:6980
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20BD.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4368
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1104
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23AB.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5776
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2364
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2968.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:2444
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:6928
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F73.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4660
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:4236
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3455.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4092
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:4668
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37EE.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:4936
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:6412
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43E5.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:6292
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5648
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C03.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5344
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1076
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50C6.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5496
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:6368
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52C9.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4492
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1148
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57CB.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:6580
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2952
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AF7.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5280
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4608
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DF5.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4376
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5588
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68E2.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3572
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5192
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C4D.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:7048
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:6628
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F1B.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4852
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:6000
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71EA.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2192
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1072
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7332.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:472
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4516
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a746B.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2028
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5924
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75B3.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:6064
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5128
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76BD.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:824
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3820
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7805.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2624
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3888
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a794D.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:928
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3544
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AF3.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5848
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:5744
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C2B.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4748
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:832
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D44.bat
                                                                                                                              62⤵
                                                                                                                                PID:6220
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:6544
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E7D.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:1596
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:3032
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F87.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:6532
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:2936
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8081.bat
                                                                                                                                                68⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                PID:3248
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3716
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81B9.bat
                                                                                                                                                    70⤵
                                                                                                                                                      PID:5888
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:1384
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82E2.bat
                                                                                                                                                          72⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:6804
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:1184
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83AD.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:5380
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5984
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84C6.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:2428
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:6976
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85A1.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                          PID:2748
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            79⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:6140
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a868B.bat
                                                                                                                                                                              80⤵
                                                                                                                                                                                PID:6416
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  81⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:4084
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87A5.bat
                                                                                                                                                                                    82⤵
                                                                                                                                                                                      PID:5388
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        83⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:3552
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88AE.bat
                                                                                                                                                                                          84⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:3928
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:3884
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89A8.bat
                                                                                                                                                                                              86⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:4888
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:6692
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AC2.bat
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                    PID:6680
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      PID:1792
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BEA.bat
                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:5836
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CF4.bat
                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:5304
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:1204
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F65.bat
                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                    PID:460
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1428
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a904F.bat
                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                          PID:4524
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2772
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a912A.bat
                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:4648
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:4220
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9243.bat
                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:1444
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:4944
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a932E.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                        PID:4980
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:1172
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9428.bat
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:1276
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:4916
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9531.bat
                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:4308
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:3308
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a962B.bat
                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                      PID:6152
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:7116
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9706.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:1348
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:2464
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9810.bat
                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                PID:2580
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:3736
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9939.bat
                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:5572
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:5016
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A52.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                          PID:5460
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:5968
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B4C.bat
                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:4196
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:5940
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C27.bat
                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:4776
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:4204
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D21.bat
                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                        PID:5456
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:2472
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DEC.bat
                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                              PID:7100
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                PID:6272
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F24.bat
                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                    PID:1304
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                      PID:1404
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA01E.bat
                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:3620
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:6908
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA118.bat
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                              PID:4364
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                  PID:5360
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA232.bat
                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                      PID:4352
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                                          PID:4284
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA32C.bat
                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:1708
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:3124
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA454.bat
                                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:5828
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                                    PID:4896
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA53F.bat
                                                                                                                                                                                                                                                                                                                                      138⤵
                                                                                                                                                                                                                                                                                                                                        PID:2236
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          139⤵
                                                                                                                                                                                                                                                                                                                                            PID:7132
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA658.bat
                                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:4320
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:3864
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA733.bat
                                                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:1300
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:7128
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA80E.bat
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:2380
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:2768
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA908.bat
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2576
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                                PID:6468
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9F2.bat
                                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:5232
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:5948
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAADC.bat
                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5244
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5576
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABC7.bat
                                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2648
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1484
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC92.bat
                                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:2072
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:6640
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD7C.bat
                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:852
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6340
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE47.bat
                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF03.bat
                                                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6396
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFDE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6620
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6952
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB183.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB29D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6768
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB358.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB433.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6644
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6184
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7012
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB675.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB740.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB992.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD99.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE45.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF10.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC097.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC152.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC375.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC421.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC50B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC682.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC72E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC951.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCFB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD046.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD298.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD344.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD40F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD596.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD651.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD71C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD884.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD930.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCCA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD66.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE12.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDECD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE006.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE092.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE11F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE257.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE47A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE507.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE63F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6FB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE797.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE824.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE96C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBAE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE8C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFA6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF032.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF17A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF217.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        352⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            353⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF294.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                354⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    355⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF311.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        356⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          357⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              358⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  359⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF459.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    360⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      361⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          362⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            363⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF572.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              364⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  365⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      366⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        367⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF67C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          368⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            369⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                370⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    371⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3844
                                                                                                                                                                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                    PID:2524
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                      PID:2436
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:4132

                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                        $$a1265.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1265.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 6f9660ecebbaff090ee263179f9b102a4d597f4a97e647cd36790e5a668a5d40
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a168C.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a168C.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 36b11f3ce4dfd0c87b8905968dad3a69a76cd0eacca7649497dd5bca30cc9714
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a19B8.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a19B8.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 977ee49e7ee9fed55ef75c59aa867b00a4f51ce4ca51ad6595002e625bc6a482
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a1D23.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1D23.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 ade63597ae777415a99f920f46f52186b0f5c9ec9909aca26958beb489d0ee8f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a20BD.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a20BD.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 4511e493e69f5e11822294d3d03561381c2c6b3d37bf64a8e387eb8a135ba8a7
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a23AB.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a23AB.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 5145200426245d66d89081bb8b77d39dd3960e51916faf55a091f03a029fc25d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a2968.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2968.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 3069521d83d019b5d711150e437dc8083252346c6cdbbeb0effa2480d6aa2048
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a2F73.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a2F73.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 8fc479f7e5f61cea18d60ec796716513beee63e74642e02e89664a839d9b0c39
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a3455.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a3455.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 ebceba9b4b5b766e7774cc481b381e2f2a364abc401a13a48ea883c08b6deee9
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a37EE.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a37EE.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 4414eb5c7b12d38e138c5d521a33c5e7e74dc03da7422e017076611958a0dbab
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a43E5.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a43E5.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 32e13fb3b6ea7d527e6c436cedcd44b06b2ea02c08ec9d189a1b98606926e1cd
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a4C03.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a4C03.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 7b0abeaf2159a6ed16e505e447e92a598552848093d817c8dd63efa797b4ae20
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a50C6.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a50C6.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 3a17bf91074bfcadd87ea6d50185c51e347e57c16a8b4690c0f275714f93cae3
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a52C9.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a52C9.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 54be1c6618b9631a702929c17d0ded2df8d58de86813b74d39439661cf936c13
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a57CB.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a57CB.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 494d2ffdbc52bde13ae749704e9fe0675b4bd80b6ff544a82f980bc530c63fbf
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a5AF7.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a5AF7.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 d54d2680b272146939157ee86fb710e46caba2722555b90410840ee1cd74cd95
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a5DF5.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a5DF5.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 71e8d60a412a0c0d8490bdf0ab5e18f140b38239d79b991643a7eda48a8f9522
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a68E2.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a68E2.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 1fbedfd4165792edd0eb3f129968a1b7ab26802a4e604c93139f8f80612ca847
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a6C4D.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a6C4D.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 1fa77e45a7f5fa7f86ff04a6b135997f368763871ff6a3de82123bb4d62eb3bc
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$a6F1B.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a6F1B.bat
                                                                                                                                                                                                                                                                                                                        • Size 776B
                                                                                                                                                                                                                                                                                                                        • SHA256 528488dc8fafd4b1029df1fb85dd34e36ef35661690dc352678169e938ea5a5e
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        $$aE3F.bat
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE3F.bat
                                                                                                                                                                                                                                                                                                                        • Size 775B
                                                                                                                                                                                                                                                                                                                        • SHA256 5f8dca9a99e6e9ba5c873764128a3f7d28e1fdbf5b08165839bab19fc9e2a692
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 de5afe3b2ef753e1b4d11afc1416132776e08486af7a0068ac6459f850c5404f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 735cf95ce079a9c733e8faff60923a1f90b82aefc183bd1ce41c462a01a44add
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b53a49bcbfd7972388dadf3731b5abc5569a18c04c53e8de9b73e1372c74ca16
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 5.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6b4226a8d22d1ec6f2eb5503f6cf9b6046612b3de610419d7f4afaa149fa6c2d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 5.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 588a3733ef6b4b4eac75a083b0ef75aac91e0d9f3f14a2e6b94550204b9bf801
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 5.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 2e056d89301b87653f5e1b43713208ebed99d6733c41443a617aed9ce6818637
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 6.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 b6b68b4bc03adcf447a801218c4e02a143be3972972479bbd216b1d57b3e201d
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 6.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6519d6fdce28a8dd6d2fccb655b7c839e46ad7bace032a99a9152fbf2dc43991
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 5.9MB
                                                                                                                                                                                                                                                                                                                        • SHA256 29b287342909230f5e2685ccf0af7bca6a3d3b1f97ecaa8259f26eb97d7b1a5a
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 5.8MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8fb7840c6ee2bd93733e85a3334b3f177c94955648066a2cd55f6a00fe541090
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 5.7MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8f6aeeae280db4e1076ed316b0f9bd8040cbc971da5145d9e688ece3b7c98c93
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 6.0MB
                                                                                                                                                                                                                                                                                                                        • SHA256 c55b96443f032066bf868ab9b6ce3f9da107510511126f61c7312b5c7c49a432
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 6.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 55f4f8f94eb62f284ab140af11ff9cbb405d7a27f874423134c92e42f755abeb
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 e74847000b68cf8a9f974fcd0242c1f74232f5fdfd918eec62f974a357ecad38
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 6.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 6819fb515da91a53418939b8a26f71a04bb706c78c5b75c67fdb0af184175ad0
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 6.3MB
                                                                                                                                                                                                                                                                                                                        • SHA256 248270caf23c7d2a2a4d6c02df14c40bbda6de46f5f4a2b42bb22b3c55e99c22
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 6.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 1365eea8072898ed7d2df09361deb43d9f8e5af4b380a7d95c1ddc88cccce41f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 8e3bc51c79d1c55a7cff830abb0e11c9d13290d95a7f2425b119448093580232
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                        • SHA256 11ba53c48c8c35c1da1f033a1fb0854e061a4acaf9dbe08969c2184e70b67602
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_fcd6ab37b85cb8a0969630abf7971adc_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                                                        • Size 6.2MB
                                                                                                                                                                                                                                                                                                                        • SHA256 99ff8d63e29ce1301a82966d241c528013834f1df9de9768d7e56992984aacf8
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        Logo1_.exe
                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        _desktop.ini
                                                                                                                                                                                                                                                                                                                        • Path F:\$RECYCLE.BIN\S-1-5-21-1014449518-1831897916-4205727055-1000\_desktop.ini
                                                                                                                                                                                                                                                                                                                        • Size 9B
                                                                                                                                                                                                                                                                                                                        • SHA256 12e486bcc6f0247b468e0bade91edf555dae9119764975498ef82717d453222f
                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                        memory/420-8799-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/616-8811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/672-8709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/688-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/776-8956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/832-8342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1004-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1072-8301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1076-5593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1104-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1148-6070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1172-8448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1184-8372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1196-8817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1204-8423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1212-8896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1228-8835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1264-9010-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1296-8703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1312-8727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1384-8367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1404-8510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1420-8968-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1428-8428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1484-8589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1564-8679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1792-8413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/1992-9004-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2100-9028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2124-8847-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2364-598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2464-8468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2472-8498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2524-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2524-1925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2524-6086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2524-8373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2524-1153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2636-8823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2768-8564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2772-8433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2896-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2896-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2936-8357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2944-8950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/2952-6082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3032-8352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3036-8914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3124-8534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3144-8805-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3148-8667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3208-8787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3224-8829-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3292-8877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3308-8458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3340-8865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3344-8883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3384-8691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3404-8643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3412-8781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3496-8775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3544-8332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3552-8398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3596-8998-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3716-8362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3720-8944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3736-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3740-8853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3820-8321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3864-8552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3884-8403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3888-8326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3892-8871-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/3912-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4084-8393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4108-8625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4132-8631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4204-8493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4220-8438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4236-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4260-8715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4284-8528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4444-8926-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4516-8306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4520-8992-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4608-6091-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4616-9016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4632-8793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4668-1935-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4688-8938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4896-8540-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4916-8453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4944-8443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/4972-8661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5016-8478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5024-8739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5080-8607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5128-8316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5192-8282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5360-8522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5372-8980-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5444-8757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5452-8745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5516-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5524-9022-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5576-8583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5588-8327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5588-8272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5648-5271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5688-9034-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5744-8337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5824-8673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5836-8418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5844-9046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5904-8841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5924-8311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5940-8488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5948-8577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5968-8483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/5984-8378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6000-8296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6004-8932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6100-8974-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6108-8902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6124-8920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6140-8388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6176-8733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6184-8655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6228-8859-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6272-8504-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6340-8601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6368-5601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6372-8697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6396-8613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6412-3816-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6420-8721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6468-8570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6480-8908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6544-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6600-8890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6628-8290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6640-8595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6644-8649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6676-8685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6692-8408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6756-8751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6768-8637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6896-8986-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6908-8516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6928-1633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6936-8769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6952-8619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6956-8962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6976-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/6980-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/7084-8763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/7116-8463-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/7128-8558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/7132-8546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                        memory/7160-9040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                                        Download