Overview

overview

7

Static

static

3

2026-09-08...op.exe

windows10-2004-x64

7

2026-09-08...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 02:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
  • Size 5.7MB
  • Sample260910-cpj45swtez
  • SHA256 ab3008b13c516592f85df47fa83b02f5928cd87681e3471d4fb146ea5a292f4d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5052
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26CD.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4988
      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:748
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28B1.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1052
          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4564
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BBE.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2732
              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:884
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F87.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4552
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:2600
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a337F.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5112
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1604
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a369B.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1048
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:3968
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a395B.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3828
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:4836
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4031.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:1240
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:2076
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4447.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4956
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3872
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4810.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:536
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:4816
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E4A.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:400
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:4720
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51A5.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4328
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:700
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a555E.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4180
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3016
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a585C.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4348
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:816
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D6D.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4324
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2348
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FFD.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:768
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4488
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a631A.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1732
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3808
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66D3.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1124
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1796
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6973.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2120
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1040
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E07.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:744
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3940
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7039.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1668
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5068
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a728B.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1336
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1488
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7366.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4712
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1060
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73F3.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3656
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4940
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7441.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3532
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:1772
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a755A.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1300
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1368
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7635.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1136
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2396
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76D1.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:812
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4420
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a775E.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4636
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2652
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7829.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2128
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1260
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7923.bat
                                                                                                                              62⤵
                                                                                                                                PID:4468
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:3780
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A0D.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:3564
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:4256
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AF7.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:4736
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:604
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CAD.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:2156
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3956
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E82.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:3932
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4964
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F9B.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:3252
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:3060
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80B4.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:1788
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:4608
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a826A.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:3220
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:3052
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8393.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:2460
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:1956
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a845E.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:4892
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:3196
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8548.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:2872
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:3772
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8875.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:1712
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:1236
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a894F.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                            PID:3860
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:956
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A1A.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                  PID:4040
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:2952
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AF5.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:1160
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:3424
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BFF.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                            PID:512
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:676
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CF9.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                  PID:2052
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:5040
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E8F.bat
                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                        PID:3792
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:740
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F4B.bat
                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:3844
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:688
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FA8.bat
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:2828
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:2688
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9064.bat
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                      PID:4196
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:4208
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9258.bat
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:3420
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:4864
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9313.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                PID:4684
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:3300
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9390.bat
                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                      PID:116
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:2304
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a941D.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:2816
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:1312
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94AA.bat
                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:4132
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:4516
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9555.bat
                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                    PID:1952
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:3396
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95F2.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:4980
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:3348
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a964F.bat
                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                              PID:2668
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:992
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96CC.bat
                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:3156
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:4592
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a973A.bat
                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:2788
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        PID:632
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97D6.bat
                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                            PID:724
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3392
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9863.bat
                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:3228
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:3488
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a992E.bat
                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                      PID:2176
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                          PID:3472
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99AB.bat
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                              PID:3232
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:3960
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A37.bat
                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:412
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:2484
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AB4.bat
                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                        PID:4268
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:4192
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B41.bat
                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:4568
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:4464
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BED.bat
                                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                                  PID:1304
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:1468
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C5A.bat
                                                                                                                                                                                                                                                                                                                                      140⤵
                                                                                                                                                                                                                                                                                                                                        PID:4896
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                                            PID:4560
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CD7.bat
                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:3996
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1120
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D64.bat
                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2848
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:4512
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DF1.bat
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:4536
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:1116
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E6E.bat
                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:4620
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4156
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EFA.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:516
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4248
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F77.bat
                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:792
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:456
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FE5.bat
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:4308
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:4828
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA062.bat
                                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3740
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2152
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0DF.bat
                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                              PID:4092
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                PID:1012
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA19A.bat
                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA207.bat
                                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA35F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA40B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA498.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA534.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA64D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3980
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA880.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA90C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA999.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA54.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC48.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE0E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB06F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB13A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB244.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB36D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB476.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB503.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB61C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB735.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB83F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8DB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB939.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA52.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB4C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBC9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC56.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCD3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD8E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE0B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE79.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFE0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC06D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC167.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC261.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC416.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC493.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC520.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC649.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC752.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC85C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC975.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAEC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:64
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC63.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCD1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDDA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEC5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD01C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD08A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD126.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:384
                                                                                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                      • Creates a file in the Startup directory
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                      PID:5048
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                        PID:4920
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:1772

                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                          $$a26CD.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a26CD.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 647814980439615d9cd565fe97a2f39e1972a36f71caa90d7e1335c746fd048e
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a28B1.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a28B1.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 925357a36b338834a734d8f95d044805765fcaa58b5dfa220ddcc642e92f372f
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a2BBE.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2BBE.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 d3d34548d67333c65b00871e6d559a5ba7911215646715d6cb27e8f5238f7c4e
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a2F87.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2F87.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 b784ef44b94080b0f71163163674323f026f7474dd2f0e4c177eae5eec701581
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a337F.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a337F.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 e1a9e0c96d771960808486193ddcc11c95f3c7383ff3759a1a0b0089275996c9
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a369B.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a369B.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 d0ce84bb63882f62eb511bf99ef79f3a31bfc3b45c79d910c33cd564e5f4ea61
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a395B.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a395B.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 43e8f1fc4ff567f282f13c2e9a064e37cff5b5abdd7dc83c8be06365bd030f12
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a4031.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4031.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 a5a0a7f418b3ea1d4ea2b803006dc3d3604a2aba844d82b4c458b652274222ff
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a4447.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4447.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 1647f2fb4067abb6ace7ee9d88bde1d4c6ac19ff565700f2b878daecad1096a5
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a4810.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4810.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 3994fc84fbc5134f2fbbbc26182029bfd3340286d8fe3f6d831a4916bf216797
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a4E4A.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4E4A.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 7cd70b35c5d8977573b6c190e831aa61a458a9e1ecdd64eea2c39c3f8ca12ff3
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a51A5.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a51A5.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 b006db4f3acb20079eb1f2e163338c39ed5e0db67ca3565c03b3177729df1918
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a555E.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a555E.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 93adafa790776e82166b5f2eaa29c652c53739185600da6dec6663f2fb3c5f7c
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a585C.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a585C.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 02c7e1936b3df79dbc4c7974e8d04ea0f3b0376e940be1e64a0c296a2411bdbd
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a5D6D.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5D6D.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 1171bc057ab423e89ef46bbde56276b73bcada3f0b52353cd9d5494507270482
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a5FFD.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5FFD.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 6a701f1ccc4500e62bb61b24f5ddaac9b48bc73114458f4d47e41105125b44f6
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a631A.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a631A.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 1be5cac9f017f8fb20257782d33be2e25eb3844b4f8275adc253f57297a8fd70
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a66D3.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a66D3.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 fe1d7eb3c801db691bdb9bcead38943065deaac17e1ef493899395aabe508ecb
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a6973.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6973.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 29f68f29c9de1a9826b8f546c48bf6bfa6716f0c1f35b09ba23e7d60067f0dd3
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a6E07.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6E07.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 d243155a283bcae56bd01742860f4b96baa4334ecbd9035ed259ba74dfadfb68
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a7039.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7039.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 8ef880bce3346dad73ef75cfa606ac31c5ff2ac3c18f1ebb9eae899d5e681a0d
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.6MB
                                                                                                                                                                                                                                                          • SHA256 90f8721e17ba76b894e1c6f7f3dece71f26ee0f2313324a115f88bd0ad0fc7eb
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                          • SHA256 cb5f4dd5aa154b76b2b70f6bcf704b31875fd794455f71e703f2960e3c12f21d
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                          • SHA256 62da0cea903c3a668735bfbee83892feab46d2514efa9560591a4032523bae8c
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.3MB
                                                                                                                                                                                                                                                          • SHA256 93f618c514df3e6e7c3c8f1abc2eb1cc875777303641606fcecc0276096631d2
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.3MB
                                                                                                                                                                                                                                                          • SHA256 5d49efdf2f40c0778af2ebc1a2ed80981f3a66eea3d819203869e3181ea9059c
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.3MB
                                                                                                                                                                                                                                                          • SHA256 19187d7125242c2e8436c2c144c6eb82c4b1382dc50646fdc6ecceae22f52ce0
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.2MB
                                                                                                                                                                                                                                                          • SHA256 22fe64e2c5e4be074333fcade5023965b9709b8f366ef66ed1d182e81fef24ac
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.2MB
                                                                                                                                                                                                                                                          • SHA256 09aefb59c46bcc2d03c1b85a12bb0b8b6742ab5b00b6eac7210f42e87cc2468f
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.2MB
                                                                                                                                                                                                                                                          • SHA256 5228bd2b0b54012fb0063805d51beec9e08b7dd6064b56f7eb0aa5d77b39fd8b
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.1MB
                                                                                                                                                                                                                                                          • SHA256 21df448809960a1e6f8053066704c58076d3afe4cd25d36fde9d55b9e2a306d4
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.1MB
                                                                                                                                                                                                                                                          • SHA256 516a1414d6a4c93eea60be230a7e694fce2e4184505caf0f09600b7ba5af579b
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.0MB
                                                                                                                                                                                                                                                          • SHA256 68f960a900b4f4d6711ca1d861e8b08015db967894ecd5044c745eadc05264db
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.7MB
                                                                                                                                                                                                                                                          • SHA256 8d82a1ea8867db941c14e4f5fd0c2ca2c9f6f9e85ff7de93f3064a849b94d82d
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.6MB
                                                                                                                                                                                                                                                          • SHA256 23595949d8570e49328dedc4c6555abfc249165faa8790f35aca77f008b0dadb
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.5MB
                                                                                                                                                                                                                                                          • SHA256 5c0a4e4a8d7f14f2166a837083d39a521d2e4983e47ec7fc982e05bc1e633c35
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.1MB
                                                                                                                                                                                                                                                          • SHA256 85d6b0758791b3de82357e2c18342318d8a05ffc1406e4da6f0b58fcfe668bfe
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.6MB
                                                                                                                                                                                                                                                          • SHA256 e9528ecc64a718f36ccc92f371c4c38ec1381960cb2554e6412937223c7c04c3
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.5MB
                                                                                                                                                                                                                                                          • SHA256 405d22c42aa6aa0dd79adb0aa535e85a17b3491cf6e0bd87dc042886677385eb
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.5MB
                                                                                                                                                                                                                                                          • SHA256 df0ce507f5f53acbe50ad0a488dcedd10ac308c6c479f580bb109e39dc63f90e
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-08_de8a6971b0e7fd49ce7f4a213dd0da78_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                          • SHA256 6d1ead0d5f4356c63686c6f975d82071d933316c68fc2cc0edc094eaa686a677
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          Logo1_.exe
                                                                                                                                                                                                                                                          • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          _desktop.ini
                                                                                                                                                                                                                                                          • Path F:\$RECYCLE.BIN\S-1-5-21-204488895-2999877624-296153668-1000\_desktop.ini
                                                                                                                                                                                                                                                          • Size 9B
                                                                                                                                                                                                                                                          • SHA256 12e486bcc6f0247b468e0bade91edf555dae9119764975498ef82717d453222f
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          memory/64-10353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/216-10062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/220-10152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/364-10348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/456-9972-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/524-10187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/604-6962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/628-10308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/632-9898-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/676-9707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/688-9850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/700-4130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/736-10278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/740-9846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/748-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/756-10102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/816-4736-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/884-43-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/956-9019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/992-9890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1012-9987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1040-5877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1060-6134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1072-10267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1116-9957-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1120-9947-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1148-10247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1236-8854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1260-6408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1312-9874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1368-6148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1380-10298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1448-10333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1464-10087-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1468-9937-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1488-6126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1524-10323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1548-10032-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1604-61-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1644-9992-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1760-10022-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1772-6144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1772-6140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1796-5729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1800-10172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1844-10343-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1956-8255-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1976-10127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1996-10097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2076-1841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2152-9982-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2304-9870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2320-10162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2336-10237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2340-10107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2348-4911-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2388-10272-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2396-6152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2484-9921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2544-10137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2600-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2636-10117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2652-6226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2684-10052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2688-9854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2768-10328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2908-10167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2912-10227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2952-9237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2968-10047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2984-10232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3016-4597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3052-8083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3060-7555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3144-10293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3196-8429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3300-9866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3348-9886-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3360-10077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3380-10197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3392-9902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3396-9882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3424-9479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3456-10147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3472-9911-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3488-9906-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3504-10283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3660-10257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3668-10288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3712-10142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3768-10262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3772-8699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3780-6594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3804-10122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3808-5599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3808-5603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3820-10252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3848-10177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3872-2278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3940-6117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3956-7200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3960-9916-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3968-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3972-10072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3976-10007-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4032-10057-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4036-10042-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4156-9962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4192-9926-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4208-9858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4248-9967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4252-10313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4256-6743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4380-10182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4384-10067-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4420-6156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4452-10217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4456-10303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4464-9931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4488-5431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4512-9952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4516-9878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4528-10222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4560-9942-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4564-29-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4584-10092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4592-9894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4600-10242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4604-10002-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4608-7881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4612-10192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4632-10207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4640-10202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4644-10212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4648-9997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4672-10012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4720-3490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4728-10082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4776-10017-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4812-10318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4816-2888-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4828-9977-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4836-1191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4848-10132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4852-10157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4864-9862-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4932-10338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4940-6138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4964-7403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5040-9842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5048-6139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5048-1503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5048-2880-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5048-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5052-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5052-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5068-6122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5092-10027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5104-10037-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5116-10112-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download