Overview

overview

7

Static

static

3

2026-09-11...op.exe

windows10-2004-x64

7

2026-09-11...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    111s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/09/2026, 09:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
  • Size 6.0MB
  • Sample260912-ls8fkswvbw
  • SHA256 11713d21c2f3edb76ab14cdca9f7f0c8a3acec417b5bbbe81b2325a80e56a403
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4400
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69CC.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:796
      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5908
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CBA.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1872
          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5680
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7248.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:460
              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4704
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7565.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2660
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:5216
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7891.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2296
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5236
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B9F.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5944
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:3876
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E4E.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4196
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:1276
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83BD.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4416
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2668
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B1F.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2896
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:3076
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E1D.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1488
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:2904
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA195.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:2944
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:3988
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA37A.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:624
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5000
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA917.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4280
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3004
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB0B.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1344
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3824
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADCA.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5772
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5252
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB07A.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3144
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:908
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB56B.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3992
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4008
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD2C.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4488
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1200
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF9D.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2556
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3900
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC26C.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2604
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3576
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC52B.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1044
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5612
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7AB.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4540
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2832
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC896.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4584
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1756
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC970.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2484
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:6140
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA5B.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3764
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3480
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB55.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3780
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5076
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC4F.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4668
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3384
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD2A.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5336
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4372
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE24.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4696
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4664
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEEF.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:1632
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1732
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFE9.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4328
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:4720
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0D3.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:5688
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:4672
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1EC.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:4428
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:3316
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2D7.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:620
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:5824
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD400.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:1464
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:5556
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4DA.bat
                                                                                                                                                      72⤵
                                                                                                                                                        PID:4572
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:4516
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5B5.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:1640
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1312
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD671.bat
                                                                                                                                                                76⤵
                                                                                                                                                                  PID:4212
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4356
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD75B.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:3852
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:1596
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD836.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:6052
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:1868
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD930.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:5092
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:4020
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA0A.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4512
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:2180
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAC6.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                          PID:3344
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            PID:4340
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBC0.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                                PID:200
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:5068
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC8B.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:3268
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:4908
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD95.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:5204
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:4652
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE7F.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                              PID:3980
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:3792
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF5A.bat
                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                    PID:4324
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:684
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE025.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:1608
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:612
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0F0.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5920
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:996
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1AC.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:2212
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:3200
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE286.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:3044
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:2952
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE371.bat
                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                          PID:3416
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE41D.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                                PID:5052
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:4384
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4F7.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                      PID:5288
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:2032
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE5D2.bat
                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:5924
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:2376
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6BC.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:588
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:2620
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7A7.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                    PID:3256
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:5524
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE891.bat
                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                          PID:3364
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:5792
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE95C.bat
                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:5564
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:5212
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA08.bat
                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                    PID:1452
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:3984
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB02.bat
                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:1936
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:1208
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBBE.bat
                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:1072
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:2964
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC98.bat
                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                  PID:3440
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                      PID:4824
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED54.bat
                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:3284
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                            PID:5860
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE4E.bat
                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:3088
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:2936
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF38.bat
                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                    PID:4168
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:2496
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFE4.bat
                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                          PID:4920
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:5388
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF080.bat
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:4208
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:1976
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF12C.bat
                                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                                    PID:1280
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:2588
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF217.bat
                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                          PID:5160
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:5904
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2D2.bat
                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                PID:4876
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:4536
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3AD.bat
                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:2452
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF468.bat
                                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5304
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:5504
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF543.bat
                                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4320
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4748
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF61E.bat
                                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4152
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:760
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6D9.bat
                                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4544
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5560
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7C4.bat
                                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4984
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3016
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8AE.bat
                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:4632
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF95A.bat
                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA16.bat
                                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAF0.bat
                                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3944
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBAC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4028
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC77.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD23.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDEE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF75.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a197.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a253.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a485.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a522.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a699.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a735.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a929.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA04.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA90.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC75.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD40.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE88.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF34.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a107C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1147.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1280.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a133B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1464.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1510.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1648.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1771.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a188A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1956.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A8E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B0B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B98.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CB1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DDA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E66.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F12.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a203B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20E7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2174.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2220.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a229D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2339.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2471.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25AA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2656.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a276F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2879.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2915.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2AF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B76.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DB8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E26.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F10.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FAC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3039.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3133.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a326B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3365.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2664
                                                                                                                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:928
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                        PID:4108
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:5924

                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                          $$a69CC.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a69CC.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 f79e80ca7c197c3fb8a41e665f23c9b79459c0edadcfae680e00fc55ebf34ea0
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a6CBA.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6CBA.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 90b3ed8650cc38f4c584be46ea04b9febe0c6ce4da5a903583ed7ffa60657934
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a7248.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7248.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 15988e748d64597e979d64938dbcd95e9b813844228a9acd9bb030ecf7e84ebd
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a7565.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7565.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 09ac3af79b79805a598cbd792ca6fb21b8886b130f650c23920acf91dcd10f02
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a7891.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7891.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 4dd6c170b0bacd77d1e1e12700b97b31216745cd52276cd04533648d85e2d094
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a7B9F.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7B9F.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 8da313996900dedb534851b5e0ec611ca5828ede548717a09a02451623b75329
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a7E4E.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7E4E.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 c89860265e1815eb61782ec9253033b819549565255e094ea502b2e527e54a7d
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a83BD.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a83BD.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 5439877ef52e1023d259604b9c1bc5173024753b6abf932b4c4d2ee926d8fd01
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a8B1F.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a8B1F.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 aa468e107f9b90f0f974046f29663f943b67f4f84eb3414006500e63dd1c7f28
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$a8E1D.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a8E1D.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 8f406877cb02b20c8e4e5a798047dad0a4dca6b77f94bcd2d37f62a605181914
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$aA195.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aA195.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 70708b20cefe32680b55c112f011cf653e05800562d1edfb88a7ab8be8e38c2f
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$aA37A.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aA37A.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 92f881d92da48c958ce4e8321032bae3cdecab837ce0b4fae9b079c75939a04e
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$aA917.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aA917.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 7e7e3ea045fc55e46c00144a09fff21d98e7624032d5552267afea8707988d73
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$aAB0B.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aAB0B.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 6174e1c7e9f9eede21dd5b3952c904c3a37ef37506a007362823ac27c0bf388f
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$aADCA.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aADCA.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 e35f41aad890a0f280eb4af101185f3f5c4bee788bfec69eab30255a92928dc9
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$aB07A.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB07A.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 b2e5cfde720f3ba1181a611b780c6b19e4a4af3fc2bd5c6d48d6961b3ea3e285
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$aB56B.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB56B.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 1b9c6e91fd18d0a0cfbedcb18cdb5e707520f8b83b807689b0bdf126e15f6991
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$aBD2C.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aBD2C.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 09a67b5cb3f245eb683dc3fa1550ee4e9897c65e8a62bd9391fb4348e10e401c
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$aBF9D.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aBF9D.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 24d99436557922c26857a1c91b66fe60f9a3efd8211234b0b25d26fd34a1c1c2
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$aC26C.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC26C.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 43877e7b86fad04c4f40bf45a3f512d5f84a714c174d0e139e5568a1fae439d6
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          $$aC52B.bat
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC52B.bat
                                                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                                                          • SHA256 e99143483da0d5917734812a4f946c6af10da6aa5ea1ec38e48fdfa67d5ee16a
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.6MB
                                                                                                                                                                                                                                                                                          • SHA256 e923026ff3b8ef0a15af3cbd92832f23e7ce9829e20612a8c0e5c9bab3abe98e
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.6MB
                                                                                                                                                                                                                                                                                          • SHA256 b0953f7317b72f08f2a5bafb53d49db81d9d51f4a67adabe70bf2b148f7f9a08
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                                                          • SHA256 9303faa572c00e68b2ac47da687d617b721101305b87594e7bef56839fe9b3ff
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                                                          • SHA256 8269e15221f3a0ee066f59d609a0487823ddd9753c71668a18a90f7cfdbad6bd
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.5MB
                                                                                                                                                                                                                                                                                          • SHA256 c68b07b11f0b9af95af6e57645f87e28903813eb139c6bee8e65b66a8d36d6e2
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                                                          • SHA256 ce3d9e0fcce7e62035cbf30045b0224d56d34e6d4d68fd3fbb5922da18c3fbf6
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.3MB
                                                                                                                                                                                                                                                                                          • SHA256 e3254ed2c9034a4448da03de9c2b5e6eb07cc223a68d9581f48279c315bd02f0
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.7MB
                                                                                                                                                                                                                                                                                          • SHA256 b1042b3938e7c8445016fba93dd670eb784ccb9a5a694a5dd21be3b952bf6a26
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.7MB
                                                                                                                                                                                                                                                                                          • SHA256 1807d94067c61037aa4d77eee225ecad0a14c31c807e687c4cf6677fc6ee04fb
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.9MB
                                                                                                                                                                                                                                                                                          • SHA256 a378231e6a13fc705b7e9091c8930bd4bdf717704defd03b7a844a504230bfdd
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.9MB
                                                                                                                                                                                                                                                                                          • SHA256 cd011efb551727dbaa50b034cb226526ef7b2d64ee00bd2c0a3a3352a53a3c5c
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.9MB
                                                                                                                                                                                                                                                                                          • SHA256 3e93268b55a3b680e0890bad21fe347fd506df23ca28a976d92ed222c48359a8
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.8MB
                                                                                                                                                                                                                                                                                          • SHA256 001f61455ec3697fdd74343d7f921a15898d025ea9718d6984430f32fed9ed5f
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.7MB
                                                                                                                                                                                                                                                                                          • SHA256 73315f4097a4920127089a697400af3bbade7a566c1dc548376cd418b0f235cf
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.8MB
                                                                                                                                                                                                                                                                                          • SHA256 a0405327ef37793b54eac4f10417a5da248fedbfe2b44a2d150fcaf7694db4e6
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.9MB
                                                                                                                                                                                                                                                                                          • SHA256 903bacb157c1bec7db8129ad152c6cea22fc687b6e190f2ac9d03468bf46d4c9
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.6MB
                                                                                                                                                                                                                                                                                          • SHA256 ca8bdfef7e8e5f7b54be6c5c9e648a83aeef21c182c661630d55198cad247c3b
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.8MB
                                                                                                                                                                                                                                                                                          • SHA256 9643b9f46ca32274df55251b488daa9f3d71de8d2a1df999c84036b0ecc6d411
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.5MB
                                                                                                                                                                                                                                                                                          • SHA256 789317ffe787a59f47c4a3dd1aa8358bc3e43c8a1b4a5d56dc337dc13c39b06b
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-11_5e8c4e5cffc3eba764221833403bd0d8_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                                          • Size 5.5MB
                                                                                                                                                                                                                                                                                          • SHA256 9359015f0839f70ab76b9ade13c27fb66042633b397a75435778113ed61a094b
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          Logo1_.exe
                                                                                                                                                                                                                                                                                          • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                                                                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          _desktop.ini
                                                                                                                                                                                                                                                                                          • Path F:\$RECYCLE.BIN\S-1-5-21-1404337215-1550464601-2805570857-1000\_desktop.ini
                                                                                                                                                                                                                                                                                          • Size 9B
                                                                                                                                                                                                                                                                                          • SHA256 b15517d69c260a90b637ea67f0832feb646c61bc48f820422512bb59ac474b71
                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                          memory/352-8682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/468-8580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/612-8249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/684-8244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/760-8399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/908-6876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/928-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/928-7402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/928-2277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/928-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/928-887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/996-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1048-8501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1104-8736-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1144-8760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1200-8084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1208-8315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1232-8748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1276-401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1312-8188-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1396-8544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1432-8832-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1468-8712-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1484-8778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1540-8670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1592-8519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1596-8198-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1732-8153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1756-8118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1868-8203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/1976-8357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2032-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2140-8784-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2180-8213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2216-8477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2260-8574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2308-8628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2316-8507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2376-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2440-8742-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2472-8706-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2496-8345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2588-8363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2612-8730-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2620-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2668-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2780-8538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2832-8113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2904-5567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2936-8339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2952-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/2964-8321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3004-6052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3008-8802-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3012-8640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3016-8411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3024-8664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3032-8718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3064-8598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3076-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3096-8381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3188-8610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3200-8259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3264-8592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3288-8429-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3300-8676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3312-8568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3316-8168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3352-8526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3384-8138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3408-8423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3460-8513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3480-8128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3568-8754-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3576-8102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3624-8622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3652-8808-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3688-8483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3748-8417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3792-8239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3808-8838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3824-6064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3876-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3880-8814-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3900-8094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3976-8658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3984-8309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/3988-5575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4000-8796-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4008-8076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4020-8208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4024-8700-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4028-8441-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4224-8862-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4244-8550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4332-8465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4340-8218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4356-8193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4372-8143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4384-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4400-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4400-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4436-8652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4508-8532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4516-8183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4536-8375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4644-8820-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4652-8233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4664-8148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4672-8163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4704-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4720-8158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4724-8826-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4748-8393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4788-8471-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4796-8562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4824-8327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4828-8634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/4908-8228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5000-6044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5024-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5044-8790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5068-8223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5076-8133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5156-8459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5212-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5216-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5236-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5252-6072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5292-8772-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5316-8453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5360-8850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5384-8844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5388-8351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5412-8447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5444-8489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5504-8387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5516-8556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5524-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5532-8604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5556-8178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5560-8405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5584-8856-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5612-8108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5620-8616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5680-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5696-8724-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5728-8694-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5764-8435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5792-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5824-8173-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5836-8688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5860-8333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5904-8369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5908-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5936-8766-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5960-8495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/5968-8646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/6096-8586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                          memory/6140-8123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                          Download