Overview

overview

7

Static

static

3

2026-09-12...op.exe

windows10-2004-x64

7

2026-09-12...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/09/2026, 00:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
  • Size 5.5MB
  • Sample260913-acdeqahn5x
  • SHA256 797a9d9b088a8a7ff18b767e1c9b310b4970525c50a0d03de6fe4fcf0926d79e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4580
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a777D.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:452
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79A0.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1884
          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5012
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DB7.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4448
              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:3852
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80B4.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3868
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2740
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8393.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:4576
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4964
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a870D.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3728
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5604
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A88.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:680
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2172
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D76.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1900
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4016
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a912F.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2904
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:5556
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C6A.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4536
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:6140
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E5E.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:5932
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:5076
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA572.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3156
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:740
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9F7.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5588
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2416
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD04.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:6056
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5304
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0CD.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1140
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5028
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB486.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4868
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3424
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB820.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4196
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1720
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE79.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3328
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:6068
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC261.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2384
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1948
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC60A.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2368
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:992
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9D3.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4524
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5372
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE67.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5620
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5436
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD184.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5512
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2348
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2AD.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3456
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2804
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD387.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4300
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4216
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD443.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2304
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3916
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD55C.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:6000
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1504
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6D3.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4548
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5632
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD898.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4368
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2472
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA2E.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3808
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3844
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB19.bat
                                                                                                                              62⤵
                                                                                                                                PID:1168
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:5396
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC22.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:5264
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:2948
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCEE.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:6004
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:2140
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE16.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:2708
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4428
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF6E.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1260
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3688
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0D6.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:116
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5552
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE318.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:4820
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:1792
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4EC.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5108
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4152
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE683.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:5064
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:4192
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE867.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4168
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:3948
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA1D.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:3460
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:3996
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB65.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:4940
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:220
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC8E.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:1268
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:660
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF18F.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                                PID:5704
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:6124
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2F6.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                      PID:1956
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:1428
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF44E.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                            PID:1880
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:3488
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF577.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:5272
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:1240
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6EE.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                      PID:1616
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:5784
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF846.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                            PID:4288
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:3352
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF9DC.bat
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                  PID:2872
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:3100
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB34.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:5300
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:2756
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBDF.bat
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                            PID:3164
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:2768
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCAB.bat
                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:5252
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:4696
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE12.bat
                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                      PID:2092
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:808
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEDD.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                            PID:3548
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:1664
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFD7.bat
                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:4688
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:5964
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2.bat
                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:4668
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:2392
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AC.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:5032
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:3184
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B5.bat
                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                              PID:1840
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4976
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AF.bat
                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:5020
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    121⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:6052
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B9.bat
                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:4720
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:5388
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E2.bat
                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                            PID:4180
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:4328
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BD.bat
                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                  PID:1748
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:3280
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B7.bat
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:2776
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                          PID:868
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B1.bat
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                              PID:708
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                  PID:1712
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BA.bat
                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                      PID:1784
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:3304
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB4.bat
                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:1728
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:3360
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCE.bat
                                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:2112
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                  PID:2492
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA8.bat
                                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                                      PID:4164
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        139⤵
                                                                                                                                                                                                                                                                                                                                          PID:2588
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD1.bat
                                                                                                                                                                                                                                                                                                                                            140⤵
                                                                                                                                                                                                                                                                                                                                              PID:4252
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                141⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:5324
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF58.bat
                                                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:1952
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4048
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1013.bat
                                                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2832
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:1816
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a111D.bat
                                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4124
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:3836
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1227.bat
                                                                                                                                                                                                                                                                                                                                                                    148⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4956
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3024
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a137E.bat
                                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5088
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14A7.bat
                                                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2956
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:512
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a160F.bat
                                                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:3680
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:5652
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1718.bat
                                                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1851.bat
                                                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5732
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1989.bat
                                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A83.bat
                                                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:64
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C0A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2568
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D71.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EAA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FE2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a210B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2205.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a231E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a259F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a265A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2754.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a287D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2948.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A91.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C56.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DEC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a307C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3128.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3212.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3389.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3474.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a353F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35DB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B4A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E19.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F80.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a404B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4107.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41A3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a422F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a431A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4452.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a450E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4646.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4702.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a485A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4905.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A8C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BD4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C51.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DC8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F3F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5087.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5181.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a525C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5385.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5440.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5598.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5644.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a570F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a579C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5838.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5961.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2820
                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Creates a file in the Startup directory
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                        PID:4588
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                          PID:4656
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:1664

                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                            $$a777D.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a777D.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 85677627800aa3f3f63f472840895777eb10c764a5743e6a4838a9defdf323f7
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$a79A0.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a79A0.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 1929842f32093af1d9c9057c36c329e5e36cffdfcb6f13d0e0c33af32187f60c
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$a7DB7.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a7DB7.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 f0296aa18793bb1c28fc23733f89ef3d661251d73c36cbf31470af783283093b
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$a80B4.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a80B4.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 ce152cb4cb17a77c93e0fe8fed417f2ad30f36f63d4f38a792ff993eada65f86
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$a8393.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8393.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 6c7a508ef3997a07d1e51036b2d1f17b3bf6cac5b63f81442f9357a4bca82a89
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$a870D.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a870D.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 06b2abbf639cf9d7c1559fd4672981592f224bb723041497c462bd602a88d29b
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$a8A88.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8A88.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 80bcca6c4b389551fe9b338bd1209ea3880ef78e7b52bce385cd95f600b24d6f
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$a8D76.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8D76.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 e384b75e1120a44c9253da5c54f000e6d29c3283571d8cf71b12a9a19baf46b4
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$a912F.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a912F.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 12756669fbc705f68ebc6adfbd0201c7bf4f242c8ab20ccae0bdb9bd1bf58a05
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$a9C6A.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9C6A.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 d2174b0a9a709c35c9fb1e914d5965192b5854019160b61ef9f027ae56a4a6b6
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$a9E5E.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9E5E.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 05a8b66da4986c49fe322779fc0b5d6e603203114cd89eb297ef2e00e7b7abbc
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$aA572.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA572.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 2925d89f77a64e3d84e081532c47c8aec9981b583401f67ff2e8907f62f79482
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$aA9F7.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aA9F7.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 4dca71c03ccc9f73d014b0257ba11743a088caf1fe635e3bd60c8b7716562f9e
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$aAD04.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aAD04.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 77195b784a2a3b33feac4adaa15366a8418559aab7b417c8f358621e5ef22a25
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$aB0CD.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB0CD.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 988a3f7fefbfcd0ea525293c5521ba009fa6b15ada8b2610ffb9c83f70f7da81
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$aB486.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB486.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 0aa47c03bbe98c497284ff45d490bd6ee960c2b560b1e2c2198e1e0ab40f98f9
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$aB820.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aB820.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 3e848161366a907f0399ee243f64e192c0bfcd8aaf7661965ef30749b5bbfb0f
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$aBE79.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aBE79.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 70cfe17b0aaaa1176015affdec24f2e22cbba29db37587fbf535bd7669230f58
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$aC261.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC261.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 4e45da9fea10cffeb3888612179ba2755a52a2636cf11359821d326ddf526273
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$aC60A.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC60A.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 06a5caddde0b79f8c97c9300b46d7ea2299db82703dfe3b3c87ada4504a1e0be
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            $$aC9D3.bat
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$aC9D3.bat
                                                                                                                                                                                                                                            • Size 776B
                                                                                                                                                                                                                                            • SHA256 4d87ad807782bafbd0c18d46da4c07b8eba7cf9661bb28db87972fb3530acd59
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.3MB
                                                                                                                                                                                                                                            • SHA256 92d27498baf58f8bc670d9b17c592f670f99c712b62ae59309301110c13c2a89
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.2MB
                                                                                                                                                                                                                                            • SHA256 5844a9e0342e84fefce18b580f52e1b051994e9f084cad63c6d0659eaa91baaf
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.2MB
                                                                                                                                                                                                                                            • SHA256 24ef23f86cc0bf8bff2863161ec9cb4bf909061038650ee40a56f2fabf2b84f7
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.2MB
                                                                                                                                                                                                                                            • SHA256 9f7f70962279c273ed9e7aa3af3f1ff29acdc87a350114ecde113486875025e7
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.1MB
                                                                                                                                                                                                                                            • SHA256 22a1e38ace08872102253528d9c95d5c88c620152ed5a09f9ed33afca86757b9
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.1MB
                                                                                                                                                                                                                                            • SHA256 f8dcd9af4cd935b457e067b0aa9e01be3ed74f779194f4f1f0f5eabf7cf94d29
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.1MB
                                                                                                                                                                                                                                            • SHA256 62d07510770496b6dd7e7f378390ae2da414c19a5cb1175407d65b9dc56f2923
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.0MB
                                                                                                                                                                                                                                            • SHA256 5c44a60434b91eca62cd1a0cc9ab3bf612e4c205cc7adc46b3041d3638ae6cb4
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.0MB
                                                                                                                                                                                                                                            • SHA256 d6426ffc43a9d4119ec0e4af5ba9eba41db4f0580e7c79c83f6c6013558698b8
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.0MB
                                                                                                                                                                                                                                            • SHA256 e103183adbf8526bcc97595decbe4823a9f4d5a4e89c0a4509367110fbb28fce
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 4.9MB
                                                                                                                                                                                                                                            • SHA256 f763a2dae7bafd87829fbeaf57a9df39d7cbb7a158754b48cca993e967cd171a
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 4.9MB
                                                                                                                                                                                                                                            • SHA256 0cbfd47ba20a5cebe23ba9b12a875f0c07cbf131103cb3048f060d7802c02b86
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.5MB
                                                                                                                                                                                                                                            • SHA256 ceca5ca1c47f6c55ab7ab56434ca1ccdb5a2b53ad98eb3c3987d98f155499321
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.3MB
                                                                                                                                                                                                                                            • SHA256 8b93d0a4e44b44483b7a5ea4749a9aecd74ed83d72ec3ba4afc2213b188312ab
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.0MB
                                                                                                                                                                                                                                            • SHA256 bd92fcf99fe1f85bdda7e52925757a568d80100cab91e3521db7175e0f93b092
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.5MB
                                                                                                                                                                                                                                            • SHA256 b898636c81ca8d0ac33560454fcc80208da5611405e18916078b407c656ee953
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.4MB
                                                                                                                                                                                                                                            • SHA256 6bc4972a60f3f9cc990cca9403c42a90a1b4522298b405ea0a79fcabfa8c47e1
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.4MB
                                                                                                                                                                                                                                            • SHA256 2ca3de675de3d30a6dbf943be4abd0ce858218c4ae66b06fef9d88c951f5d465
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.4MB
                                                                                                                                                                                                                                            • SHA256 03f37cb252a8ae1dbfbade64413b7425d8fa143cf41733ac8e13f28c6316d5ae
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_6aabea2b33d37fb36274188c829f145c_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                            • Size 5.3MB
                                                                                                                                                                                                                                            • SHA256 cc749eec9b251f95bd646851cf2b1f6ee06014d986781404e417fd28b5458003
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            Logo1_.exe
                                                                                                                                                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                            • Size 32KB
                                                                                                                                                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            _desktop.ini
                                                                                                                                                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-681733028-2344970462-962213935-1000\_desktop.ini
                                                                                                                                                                                                                                            • Size 9B
                                                                                                                                                                                                                                            • SHA256 91ce508664b3b3a1db2fc772a0b719947694487d2d31329da16f37daa9a4167b
                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                            memory/112-10623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/216-10663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/220-8689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/452-19-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/512-10372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/660-8836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/740-2721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/748-10573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/752-10713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/808-10269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/868-10311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/992-5333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1072-10492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1240-9608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1264-10507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1428-9252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1504-5917-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1536-10382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1656-10683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1664-10273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1672-10703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1712-10316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1720-4940-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1740-10568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1744-10698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1752-10517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1792-7115-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1816-10351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1820-10673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1832-10728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/1948-5197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2136-10512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2140-6227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2172-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2176-10477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2184-10532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2212-10693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2348-5682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2392-10282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2416-2986-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2460-10738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2472-6207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2488-10397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2492-10331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2568-10402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2588-10336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2688-10563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2740-49-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2756-10256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2764-10482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2768-10261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2804-5686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2920-10588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/2948-6223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3024-10361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3040-10527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3076-10522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3100-10252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3104-10487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3140-10633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3184-10286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3260-10678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3280-10306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3304-10321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3352-10092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3360-10326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3424-3361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3488-9372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3504-10718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3688-6393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3696-10417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3836-10356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3844-6211-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3852-36-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3916-5703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3948-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3976-10537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/3996-8531-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4000-10593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4016-219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4028-10648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4044-10432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4048-10346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4072-10547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4152-7385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4156-10603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4192-7943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4216-5690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4328-10302-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4360-10668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4412-10497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4428-6231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4464-10618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4484-10407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4544-10472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4580-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4580-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4588-5169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4588-8738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4588-1889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4588-2508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4588-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4596-10502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4608-10583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4652-10708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4672-10437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4684-10578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4696-10265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4768-10427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4964-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/4976-10290-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5012-28-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5028-3292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5052-10412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5076-2576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5100-10557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5124-10628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5132-10723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5156-10392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5184-10467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5288-10462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5304-3161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5324-10341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5372-5564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5376-10608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5388-10298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5396-6215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5400-10552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5436-5678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5520-10447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5528-10422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5552-6777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5556-1941-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5604-67-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5608-10457-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5632-6183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5640-10367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5652-10377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5728-10598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5732-10387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5736-10743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5740-10733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5744-10658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5784-9792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5796-10758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5812-10452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5832-10542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5856-10442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5868-10638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5892-10613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5944-10653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5952-10688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/5964-10277-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/6012-10753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/6048-10748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/6052-10294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/6064-10643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/6068-5104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/6124-9062-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                            memory/6140-2106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                            Download