Overview

overview

7

Static

static

3

2026-09-12...op.exe

windows10-2004-x64

7

2026-09-12...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/09/2026, 22:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
  • Size 5.7MB
  • Sample260912-2lcckayxes
  • SHA256 e68564f94900b25470dca26a9cb24f5c5e7d43e68b7b312ff05d54da09870956
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68C2.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2420
      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5716
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B91.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5204
          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2716
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E9E.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5964
              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4128
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7258.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3272
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4324
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7517.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5736
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4520
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78D0.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3608
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1828
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A85.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4688
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:4444
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D83.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2764
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4628
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a813C.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5844
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:2360
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A73.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4780
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:2144
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E0D.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:2484
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:3512
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A90.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5096
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:840
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA203.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1264
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5832
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3E7.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1040
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4956
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA985.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5680
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:52
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACC1.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3764
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5104
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF61.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3084
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3184
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB973.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:796
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1752
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBE4.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2580
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2148
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF20.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2328
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3604
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1CF.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2564
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:704
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC51B.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2084
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1496
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6A2.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1056
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5496
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC75D.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4296
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4136
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC867.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5200
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5940
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC942.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4612
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5660
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA2C.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5960
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1148
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB16.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3944
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:908
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC10.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4948
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:292
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD0A.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4868
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1852
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE14.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:2112
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:2208
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF0E.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:3948
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:1776
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFF8.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:4272
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:972
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0F2.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:2700
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:728
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1DD.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:5328
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:1456
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD306.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:2884
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:4464
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD400.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:4812
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4944
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD538.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:596
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:1944
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD622.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:2064
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:3688
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD71C.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:6012
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:1544
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD836.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                    PID:4848
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1528
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD93F.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:5572
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:2892
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA59.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                              PID:3016
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:1172
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB91.bat
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                    PID:1256
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      89⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:2704
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCCA.bat
                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:4436
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE31.bat
                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:4388
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:5600
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF69.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                  PID:3428
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:1696
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE054.bat
                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                        PID:4440
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE13E.bat
                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:5020
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:5584
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE238.bat
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                  PID:1232
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:3908
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE303.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                        PID:248
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:2292
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3EE.bat
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:296
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4692
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4C8.bat
                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                  PID:1652
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:4300
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5C2.bat
                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:2660
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:5876
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69D.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:4640
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:1044
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7A7.bat
                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                PID:4508
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:3628
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8D0.bat
                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                      PID:2732
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:4912
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9D9.bat
                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:5560
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:4204
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAE3.bat
                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                PID:3328
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:1088
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBCD.bat
                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:1592
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:2776
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECD7.bat
                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:1336
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:1596
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDB2.bat
                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:6000
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:3448
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE9C.bat
                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                  PID:4304
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    PID:836
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF96.bat
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:2584
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        PID:2352
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF080.bat
                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                            PID:2920
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                PID:3588
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF17A.bat
                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:3452
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                      PID:5748
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF265.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                          PID:200
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                              PID:1424
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF34F.bat
                                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:3548
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  137⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:5696
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF41A.bat
                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                      PID:4936
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:2560
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4D6.bat
                                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:1488
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                              PID:2412
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5DF.bat
                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5860
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2388
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6AB.bat
                                                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:3596
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4364
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7A5.bat
                                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:4972
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5628
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF87F.bat
                                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3156
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:3060
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF989.bat
                                                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:4604
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:5404
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA83.bat
                                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:4916
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:624
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB4E.bat
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:1772
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:5452
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC38.bat
                                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3936
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                          157⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:4620
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD23.bat
                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2948
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a735.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a977.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD40.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF63.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a100F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1186.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1241.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a131C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1474.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a152F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1619.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1781.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a182D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A50.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BC7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F60.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a202C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2174.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2210.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2377.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2423.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a256B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2608.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a275F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2888.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2944.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D4B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E06.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EB2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a300A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3097.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3133.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a326B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3317.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3440.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3644.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a378C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3838.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3961.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6072
                                                                                                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Creates a file in the Startup directory
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                PID:3200
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                  PID:5956
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:260

                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                    $$a68C2.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a68C2.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 63381997e17ac927e01fa28e5236d340a89735dbe713ba49db0c9eca2f60b422
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a6B91.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6B91.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 657fe2787b3f83985ef01bd5c0045cc7e4501be4ac0d3d36dc1794b7c0a2dae9
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a6E9E.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a6E9E.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 dc2b1aff221748fa1de69a34f880802d65748ffff49f39c5d3744b40696ebe92
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a7258.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7258.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 e13b2f7133645545927703fa412141393578aca06ab1493a4b611d69bc44a6cb
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a7517.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7517.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 94170170f0073d48bf776f3ec92864b17b0c4564c154fd5cfc87b61380081411
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a78D0.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a78D0.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 5c803737d8415eed452be70fa03cf15380f153e8b9a4bfd81ff6ebf23fffcdc9
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a7A85.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7A85.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 912cbef1f636bcec09da3fcfe3e74bcc2c20536713e8b62c44defc328d95ebc2
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a7D83.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a7D83.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 e606a0011b6fe7bce5d92e15fa2ecba3053cd90ab0e216059776ef2be1b146d0
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a813C.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a813C.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 c302a410f4ae66e3b14dc2c15f69857d3cf940c614332c08ec9fd1e610d712d4
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a8A73.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a8A73.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 bcec46478a89302753579dce8417537472aa43a74e1ed2ce21cfff5ff44aa076
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a8E0D.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a8E0D.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 da22bbcab603151cc46add60de17f36164606bea7b7c7b9b230c2aae5f8a4c18
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$a9A90.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a9A90.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 60d10315813c969ea90579d46f705e9885d0055a5fda71a4b71e127ccf5eae43
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$aA203.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aA203.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 1f657fb66617166ad0115411f32c68f1e024f3725c5ac0354fc4bbf070e96d32
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$aA3E7.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aA3E7.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 5edd41574138fc1de3b83892566dfb7838967f5c429abfef8d9a5894f6b00a8c
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$aA985.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aA985.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 4afe1f66cbb2e2fdb6e974c47cce61df0f240793e4297b2f0bb6a25737c20678
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$aACC1.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aACC1.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 6b766ddd916ca3de86ba0183d6997f2d8ec3678221de4d42c58f7f2b57a63944
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$aAF61.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aAF61.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 8aef9b098b5e969d00c26f5183743b939a7f10c497821b75b4457cc619deee98
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$aB973.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aB973.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 5f1bd515e1b8e59123a2d7a59cf027761285c8d6d605df7d57c86b552b1b1e78
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$aBBE4.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aBBE4.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 3669f63d3b367afb31205b05d976cb202aaa079bc388d8f935f92b4df5d99c65
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$aBF20.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aBF20.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 8174c6a002aac4c149ec60e978b39fcd7b2b53f02b9d90ed41d50ba9cb7b8647
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    $$aC1CF.bat
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC1CF.bat
                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                    • SHA256 ae4529dc6650114c22744993055e48bb13b1427252ec7bbc4eb9280fa231f2a7
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                                    • SHA256 e073dfcfcf7987208a0f85a3261efdc006792d8db9c5a1b9f9f63a22c56171e3
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                                    • SHA256 e32a1898325f32c15059026e4f2c07b9f726dab7f06673739688af59ee4ee08e
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                                    • SHA256 30d7d6e5b02df9a81843b51f58fb323c7be3509963d229d7252389ecc446f3ca
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                                    • SHA256 8bb101d116959e702e19e22d6c351e4f4394e1c9bfb3f38fbd1541fa0899379f
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                                    • SHA256 3c5206a5126913742b23f64418c67766fcac00a4dc96f71220f17ea6ef47357c
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                                    • SHA256 5960473aeced23926009e49bf511688ddf57b3c5e5dbbe33b6df3ae380a07113
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                                    • SHA256 9c8b98db85958fa50df1e682706ae201f65fd6cdd9d295af3a7ce34a20bcaafb
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                                    • SHA256 afd8fa716e2e5fe7d5740dd83330941d4c0d4108acc7faaabc7d1be4ad1820af
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                                    • SHA256 468344dd77b7550ab3559334ec2804a31635c1ac432f3e84b9fdf6f869836c98
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                                    • SHA256 e620e191915c822c7e4ded707ef13cf97486e468400fb3f36eeba54282ef4537
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.5MB
                                                                                                                                                                                                                                                    • SHA256 cd0d70732a93da66dfddc7dd6e95cb8184d90154eb1e092c7b36c32014b9e962
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.4MB
                                                                                                                                                                                                                                                    • SHA256 2cbf4993d9ed256345df670b5dfb8e08297417ecea23f0ee96a196dacf143943
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.6MB
                                                                                                                                                                                                                                                    • SHA256 b81d0af992eee98714d3def8175a451aea5a97c97306c4948c2373f818340fd2
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.6MB
                                                                                                                                                                                                                                                    • SHA256 bb70f42894fa9e1f304fc2d82aa845ff68b4075f033a91a415fed53234a5b139
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.5MB
                                                                                                                                                                                                                                                    • SHA256 18cc3a8e1f27cedcce351cb8975b704b16b05443fa5a54c16fedcfed8601f8a3
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.4MB
                                                                                                                                                                                                                                                    • SHA256 70db7bcaeac77ec740bf1ce5d144f6415a28237ce481bb9592f105ff65046fae
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.6MB
                                                                                                                                                                                                                                                    • SHA256 941e90d2aba8169e20c7c5ae8744a31b0cf9e38a668d045ead7c612bc86374c1
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.4MB
                                                                                                                                                                                                                                                    • SHA256 a0ec2a5f42161eeb3f0c40e48f6758dc2155c53973fada26d73ec0f045684348
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.5MB
                                                                                                                                                                                                                                                    • SHA256 848fc9fd2ea3f190864fb50611daae4a39465b744d18554f3d84d27200f32aab
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_806225658e60f8b3b411058418ca4c6a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                                    • SHA256 ba75c217b81d8a11b90b472edb506d3029a948ce7d924e689fa251ff65f7bb8b
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    Logo1_.exe
                                                                                                                                                                                                                                                    • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                    • Size 32KB
                                                                                                                                                                                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    _desktop.ini
                                                                                                                                                                                                                                                    • Path F:\$RECYCLE.BIN\S-1-5-21-560646293-820748483-2532804640-1000\_desktop.ini
                                                                                                                                                                                                                                                    • Size 9B
                                                                                                                                                                                                                                                    • SHA256 b15517d69c260a90b637ea67f0832feb646c61bc48f820422512bb59ac474b71
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    memory/52-6072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/256-8656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/292-8314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/620-8993-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/624-8565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/704-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/728-8339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/808-8818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/836-8487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/840-5583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/908-8309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/972-8334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1008-8836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1044-8445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1088-8465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1100-8644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1148-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1172-8384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1328-9017-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1340-8722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1416-8728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1424-8511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1456-8344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1496-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1528-8374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1544-8369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1580-8920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1596-8475-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1624-8896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1680-8860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1696-8405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1752-8250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1776-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1812-8698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1828-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1852-8319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1928-8662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1944-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2016-8999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2060-8650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2144-1946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2148-8260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2196-8932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2208-8324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2228-8969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2292-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2304-8848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2332-8776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2352-8493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2360-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2380-8812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2384-8866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2388-8535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2408-8632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2412-8529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2452-8824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2492-9029-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2532-8944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2560-8523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2616-8716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2628-8842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2652-8758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2704-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2716-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2756-8595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2776-8470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2864-8950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2892-8379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2896-8680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2900-8956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2936-8583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/2984-8800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3008-8788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3060-8553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3088-8770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3184-8242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3200-2510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3200-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3200-1692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3200-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3200-8236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3208-8619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3244-8752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3312-8872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3364-8854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3400-8794-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3448-8481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3484-8601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3512-4262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3588-8499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3604-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3628-8450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3660-8625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3676-8638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3688-8364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3788-8926-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3808-8884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3832-8975-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3908-8420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4056-8746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4128-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4136-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4204-8460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4260-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4260-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4288-8410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4300-8435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4320-9023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4324-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4328-8782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4364-8541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4436-8394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4444-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4464-8349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4504-8987-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4520-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4572-8878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4620-8577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4628-260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4692-8430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4732-8740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4752-9005-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4760-8734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4764-8613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4804-8806-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4816-8908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4912-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4944-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4956-6060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5000-8704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5104-6080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5192-8589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5208-8890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5216-8902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5348-8830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5392-8963-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5404-8559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5428-8710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5452-8571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5464-8686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5496-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5516-8607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5584-8415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5600-8400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5628-8547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5660-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5696-8517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5716-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5744-8692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5748-8505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5780-8668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5784-8914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5832-5591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5876-8440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5888-9011-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5920-8674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5932-8764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5940-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5968-8938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5996-8981-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                    Download